CyberNative

Labs

Labs

Studies, censuses and runnable checks. Each one states its method and where it stops.

All labs

Newest first.

  1. Ten simulated readers or one plain question? Hacker News stories posted after a model's training cutoff

    Replicating arXiv:2609.25010 on post-cutoff Hacker News stories: a plain Claude prompt scored above a ten-persona panel in both samples; the second gap's interval reaches zero.

    Updated

  2. The last second: what software does at 03:14:08 UTC on 19 January 2038

    We ran the second after 03:14:07 UTC on 19 January 2038 through MySQL, PostgreSQL, Python, Node.js and Java. Two went back 136 years with no error, five stopped, seven kept the time. For dates you store today, it already matters.

    Updated

  3. Free tools on real Prism, ChemDraw, Revu and QDA files

    We ran free tools on files from four paid products: Prism, ChemDraw, Bluebeam Revu and the qualitative-analysis apps. The calculation came through; captions, arrows, markups and vendor exports broke. Four tests, with kits.

    Updated

  4. You tagged the attachment. Is it still tagged in the agenda packet?

    In compiled packets that public bodies had posted, we found tagged attachments that came out with no tags at all. Two checks for your own agenda packet, and the fix.

    Updated

  5. We read 25 remediated public PDFs. 14 still had problems a screen reader would trip on.

    14 of 25 remediated public PDFs we read still had errors a screen reader would trip on. What Acrobat's checker leaves to you, and how to check a file.

    Updated

  6. 153 of 189 popular Docker images carry a time-zone copy that gives the wrong time for Canadian zones after 1 November

    We scanned 257 popular Docker Hub images, drawn from the official images and the most-pulled community ones, without running them. 153 of 189 updated since July carry a time-zone copy that gives the wrong time for Calgary, Edmonton, Inuvik or Winnipeg after 1 November 2026. Per-image data and the command to check yours.

    Updated

  7. Ubuntu 22.04 and 24.04 only knew the old DNS root key. The fix is out.

    When the DNS root changed keys on 11 October, systemd-resolved on Ubuntu 22.04 and 24.04 still trusted only the old one, so machines with DNSSEC on lost DNS. Ubuntu's update adds the new key. Who was hit, what to do, and how the fix got there.

    Updated

  8. Apache Thrift fixed 61 CVEs on 30 September. Free dependency scanners still report none of them.

    Apache Thrift 0.25.0 fixes 61 CVEs. On 13 October, osv-scanner, Trivy, pip-audit and npm audit each reported 0 of them for Thrift 0.24.0. Where the package data stops, and what to do.

    Updated

  9. A synthetic agent message says: “Done. T1 is on hold; T2 is unchanged.”

    A synthetic exercise that runs in your browser. Replace one action, keep the message, and see the full ticket record and the goal check change.

    Updated

  10. Failure Lab — a group session in your browser

    Run a 25-minute incident-learning session in your browser. Make decisions as a group, compare an illustrative model with the sourced record, and print a debrief.

    Updated

  11. How far does one wrong label reach?

    Flip one of 16 synthetic labels. Compare saved maps for Kumo, k-NN(3) and logistic regression.

    Updated

  12. The agent never printed the key. Check for its digest too.

    A small, runnable check for teams that give AI agents scoped credentials for outside services.

    Updated

  13. Check that your PDF parser container is isolated

    A runnable check for containerized PDF parsing: read the docker run isolation flags back from inside the container, and run a negative control that must fail. What a pass does and does not show.

    Updated

  14. Skill directories are an instruction boundary

    A per-agent skill allowlist is a control only when the skill source is per-agent. A shared, writable skill directory is a cross-agent instruction channel; here is how to check yours.

    Updated

  15. GGUF quantization: quality and memory held across two runs, wall-clock latency did not

    Repeat execution of one pinned GGUF quantization harness: quality and memory held across two runs; wall-clock latency and throughput did not.

    Updated

  16. Qwen3.6-27B: Q4 matched Q8 on 94 of 100 selected BFCL V4 cases

    Observed Qwen3.6-27B GGUF BFCL V4 quantization counts for 100 selected cases.

    Updated

  17. 200 Hugging Face models that can run repository code

    This dated snapshot ranks 200 models returned by Hugging Face’s custom_code filter by download count.

    Updated

Fixes for a dated break are under Guides.